Web clipper extensions reviewed: Evernote, Notion, Raindrop & Obsidian permissions compared

A web clipper is one of the few extensions you actively want to read the page you're looking at. That's the whole job — grab the article, the recipe, the research note, and drop it into your second brain. But "read this page" is exactly the capability that, pointed the wrong way, turns any extension into a surveillance tool.

So I pulled four of the most-installed clippers — Evernote Web Clipper, Notion Web Clipper, Raindrop.io, and Obsidian Web Clipper — and lined them up on the two axes that actually matter: how much of the web each one can read, and where your clipped content ends up once it's grabbed.

Quick verdict

• Obsidian Web Clipper — broad page access, but everything lands in a local vault. Open source, no account, per Obsidian's own docs nothing leaves your machine unless you set up sync yourself. My pick if you care about privacy.
• Raindrop.io — the narrowest permissions of the four. Per Raindrop's help docs, it reads the current tab only when you click, and only asks for broad site access if you turn on highlights. But your URLs and titles do sync to its cloud.
• Evernote Web Clipper — the classic. Reads full page content, requires an Evernote account, and clips live on Evernote's servers. You can scope its site access down in Chrome, and most people never do.
• Notion Web Clipper — account-gated and cloud-first, but the official clipper is fairly limited in what it grabs. Watch out for the third-party "Save to Notion"-style clones, which ask for a lot more.

The short version: permission breadth and data destination are two different questions, and the most private option here has the widest permission. That surprised me too. Let me explain.

What these extensions actually do

All four solve the same problem — you found something worth keeping and you don't want to lose it in a sea of bookmarks. Click the icon, the page gets saved somewhere you can find it later. Simple on the surface.

Underneath, they split into two camps. Evernote, Notion, and Raindrop are cloud services with an extension attached — the clipper is a front door to an account, and your saved stuff syncs to their servers so it shows up on your phone. Obsidian is the odd one out: it's a local-first note app, and its clipper writes Markdown straight into a folder on your own disk. No account, no server round-trip.

That single design choice — cloud account vs. local vault — drives almost everything about each extension's privacy profile. Keep it in mind as we get into permissions, because it's the reason the numbers don't line up the way you'd expect.

Security analysis: the permission every clipper has to justify

Here's the mechanical truth. To clip a page's content — not just its URL, but the actual text and images — an extension needs to run code on that page. In Chrome's model that's either the activeTab permission (read the page you're on, but only right after you click the icon) or a standing host permission like <all_urls> (read every page, all the time, no click required).

That distinction is the whole ballgame, and I broke down both sides of it before — the good-citizen pattern in my piece on the activeTab permission, and the scarier one in what "read and change all your data on all websites" really means. Short version: activeTab grants nothing until you invoke the extension; <all_urls> is a permanent window into your entire browsing session.

Raindrop.io is the model citizen. Per its documentation it runs on the current tab only when you click it, requesting just storage, tabs, and activeTab by default. It only escalates to broad site access if you switch on extras like the "already saved" page indicator or the highlighter. If you skip those, it never has standing access to anything.

Obsidian Web Clipper takes the opposite approach: it asks to run on all websites up front, because it reads and converts full page content wherever you clip. On paper that's the broadest access of the four. But — and this is the point — that access feeds a local file, and the code is open source, so anyone can check what it does with the page it reads.

Evernote and Notion sit in the middle. Both read page content to build a rich clip, and both let you narrow their site access in Chrome's extension settings (run on all sites, only on click, or on specific domains). Evernote's clipper exposes this control directly, which is genuinely good — but the default most users accept is the wide one.

Where your clips actually go

This is where the cloud-vs-local split pays off. A permission tells you what an extension can read. The privacy policy tells you where that reading ends up.

Obsidian wins cleanly on destination. Clips are Markdown files in your own vault. There's no account, and per Obsidian's docs the developer hasn't identified itself as collecting your data. Broad permission, zero exfiltration — the access never leaves your disk.

Raindrop is honest about the trade. To save a bookmark it sends the page's URL and title to its servers, and account setup needs your email. Per Raindrop's privacy stance the data is encrypted in transit and not sold to third parties. So you're trading a little metadata (where you saved from) for real cross-device sync — but the full page text isn't the payload unless you clip a permanent copy.

Evernote stores your actual clipped content — text, images, whole articles — on its servers, tied to your account. That's the point of Evernote; it's a memory system, not a local tool. Reasonable if you trust the vendor with your notes, but understand that "clip this page" means "upload this page."

Notion is similar for the official clipper, though it grabs less by default — often just the link, title, and a highlight rather than the entire page body. The bigger caution is the ecosystem of third-party "Save to Notion" clippers: some are excellent, but they frequently request the full read-and-change-all-sites permission, and a couple have changed hands over the years. Treat any non-official clone the way you'd treat any small-developer extension — check who ships it and when it last updated.

Privacy score breakdown: how I'd rank them

I'm not going to stamp a fake "9.2/10" on each — anyone can invent a number. Instead here's the axis Extenshi's scanner actually weighs, and roughly where each clipper lands.

Data residency. Obsidian is the clear winner — local vault, nothing transmitted. Raindrop sends only URL/title metadata. Evernote and Notion upload the clip itself. If "does my content leave my machine" is your top question, the order is Obsidian → Raindrop → Notion → Evernote.

Permission breadth. Raindrop is tightest (activeTab, on click). Evernote and Notion are scopeable but usually wide. Obsidian is broadest by default — but paired with local storage and open code, that breadth is far less scary than it looks in the install prompt.

Account exposure. Obsidian needs no account, so there's no identity data to leak. The other three tie your clips to an email the moment you sign in.

Track record. All four official clippers are actively maintained by the companies behind the products, which matters more than people realize. An abandoned clipper still holding page-read access is a slow-motion liability — the exact risk I dug into in my post on abandoned extensions. The clones and forks are where that risk actually lives.

Alternatives and how to pick

If none of the four fit, two more are worth a look. Karakeep and Linkwarden are self-hostable, open-source bookmark-and-clip tools — more setup, but you own the whole stack. And Chrome's own reading list / bookmarks handle the "save a link" case with no extension at all, if you don't need the full-text capture.

My actual decision tree is short. Want the most private option and you're fine with a local notes app? Obsidian Web Clipper. Want lightweight, cloud-synced bookmarks with the tightest permissions? Raindrop.io.

Already deep in Evernote or Notion and you just want the official clipper for that service? Use it — but open Chrome's extension settings and switch its site access from "on all sites" to "on click." That one toggle turns a standing read-everything permission into a read-only-when-I-ask one, and you lose almost nothing.

Whatever you pick, do the 30-second check yourself: open the extension's Chrome Web Store page, read the "permissions" and "privacy practices" sections, and confirm the last update is recent. A clipper that can read every page but hasn't shipped an update in two years is running code nobody's watching over your entire browsing session.

FAQ

Is the Evernote Web Clipper safe? The official Evernote clipper is actively maintained and reads full page content to build a clip, which lands on Evernote's servers tied to your account. It's reasonable if you trust Evernote with your notes — and you can narrow its site access in Chrome from "on all sites" to "on click" to shrink what it can read.

Which web clipper is the most private? On data destination, Obsidian Web Clipper wins: clips are Markdown files in a local vault, no account, nothing transmitted unless you set up sync yourself. It asks for the broadest page access of the four, but that access feeds a local file and the code is open source.

Does a web clipper read every page I visit? Only if it holds a standing host permission like <all_urls>. A clipper built on activeTab (Raindrop.io's default) can only read the tab you're on, and only right after you click it. Check the extension's "site access" setting in Chrome — "on click" beats "on all sites."

Are third-party "Save to Notion" clippers safe? Treat any non-official clone like any small-developer extension. Several request the full read-and-change-all-sites permission and a couple have changed hands over the years — check who ships it and when it last updated before installing.

How Extenshi helps

You don't have to take a vendor's privacy policy at face value, and you definitely shouldn't trust a random "Save to X" clone by its star rating. Extenshi scans extensions for exactly this — which permissions they request, whether they reach past what the feature needs, and whether the listing carries the red flags (ownership churn, dormant code, quiet permission creep) that turn a handy tool into a risk. Drop any of these clippers into the catalog and you'll see the permission and data-flow breakdown in plain language instead of legalese.

See the full security report for your web clipper → catalog.extenshi.io

Running a dozen extensions and not sure which ones quietly read every page you open? Scan your extensions and find out before your next research binge.

---

This article is based on publicly available information and the cited vendors' own documentation and privacy policies. Extenshi does not independently verify all claims made by third parties. References to specific companies or products reflect the findings of cited sources and do not constitute accusations of intentional wrongdoing. If you believe any information is inaccurate, please contact us at [email protected].